Password Security [2026]: 5 Mistakes That Get Accounts Hacked

I spent years in IT security. The advice I gave to end users was often simpler than what I actually did myself — because the full picture is complicated and people don't follow complicated advice. Here is the unfiltered version: what people who actually think about security do to protect their accounts, not the simplified version we give to non-technical colleagues.

The Password Manager Question Is Settled

If you're not using a password manager, you're either reusing passwords across sites or you're memorizing dozens of unique passwords, which is not realistic for most people. Both alternatives are worse than the password manager. This is not a "best practice recommendation" — it's the actual behavior of every security professional I've worked with. We all use password managers. The debate is which one, not whether.

The options worth considering in 2026: Bitwarden (open source, independently audited, the most recommended among security-conscious people I know), 1Password (excellent UX, team features, slightly more expensive), and the built-in options from Apple and Google, which are significantly better than they used to be and adequate for most non-high-risk users. I personally use Bitwarden and have for years. The open-source and auditable nature matters to me; the UX is good enough.

What to look for: end-to-end encryption (your master password never touches the company's servers in unencrypted form), independent security audits, breach monitoring, and cross-device sync that doesn't require you to trust a third-party cloud with your plaintext vault. All of the options above meet these criteria.

Two-Factor Authentication: The Hierarchy That Matters

Not all 2FA is equal, and most discussions don't explain the hierarchy clearly. From strongest to weakest: hardware security keys (FIDO2/WebAuthn — a physical device like a YubiKey), authenticator app TOTP codes (Google Authenticator, Authy, the authenticator built into Bitwarden or 1Password), and SMS codes. SMS 2FA is significantly better than no 2FA, but it's vulnerable to SIM-swapping attacks — someone convinces your carrier to transfer your number to a new SIM they control.

What I actually do: hardware security key for my most critical accounts (email, password manager, financial accounts, work accounts). Authenticator app TOTP for everything else that supports it. SMS as an absolute last resort only when nothing else is offered. Many people stop at SMS and feel like they've "done 2FA" — they've done the weakest version of it.

The authenticator app placement in your phone matters. The goal is that someone who has your phone and knows your phone PIN still can't get into your accounts. Using an authenticator app that's protected by a separate PIN or biometric (most apps now support this) means even full phone access doesn't automatically grant account access.

Email Security: The Account That Matters Most

Your email account controls everything else — it's the recovery mechanism for most other accounts. A compromised email account means a compromised everything. This means your email account deserves the strongest security: a unique, long password, hardware key 2FA if available, and careful attention to recovery options (recovery email and recovery phone number should also be secured).

The email provider matters. Gmail and ProtonMail both have strong security track records; the difference is whether you trust Google with your email content. ProtonMail's end-to-end encryption means even ProtonMail can't read your email. Gmail's content is readable by Google (they say they don't use it for ad targeting anymore, but the capability exists). For most people, Gmail's security is fine. For high-risk individuals — journalists, activists, people with specific adversaries — ProtonMail's architecture provides meaningful additional protection.

The Threat Model Question Most People Skip

Security professionals think in threat models: who might try to compromise your accounts, how, and with what resources? The answer changes the recommendations significantly. For most people, the realistic threats are credential stuffing attacks (someone uses your email/password combination leaked from another breach to try logging in elsewhere — password managers and unique passwords solve this), phishing (fake login pages — 2FA and browser-based password manager autofill that won't fill on wrong domains helps), and opportunistic attacks. For high-profile individuals, the threats are different and the mitigations are correspondingly more intense.

The mistake most security advice makes is ignoring threat modeling and giving everyone the same advice. Unique passwords and a password manager is the right baseline for nearly everyone. Hardware security keys are the right next step for high-value accounts. Beyond that, the right answer depends on who you are and who might target you.

The Things People Get Wrong

Frequent mandatory password changes: the research is clear that forcing regular password changes produces weaker passwords (people use predictable patterns) without meaningfully improving security. Change passwords when there's a reason — a breach, a suspected compromise — not on a calendar schedule. Security questions: these are often less secure than passwords, because the answers (mother's maiden name, first pet's name) are often publicly findable or guessable. Use random strings stored in your password manager as answers to security questions, not actual answers. Public WiFi: the risk is lower than it used to be thanks to widespread HTTPS, but using a reputable VPN on genuinely untrusted networks is a reasonable precaution.

My honest take: Password manager + unique passwords + authenticator app 2FA covers 90% of what matters for most people. Add a hardware key for your email and password manager accounts. Stop changing passwords on a schedule and start changing them when you have a reason.